GranurGranur
Log ind
Free checklist · 35 checks

Third-party risk checklist

What to check before, during and after bringing on a vendor or AI tool, with the SOC 2, NIST, HIPAA, state privacy, AI law and financial-sector points flagged.

  • • Seven stages, from the first request to offboarding
  • • How to actually read a vendor's SOC 2 report
  • • Where HIPAA, state privacy laws and state AI laws come in
  • • The contract and renewal terms that cost SaaS buyers the most
  • • A printable PDF with tick boxes

Operating in Europe? Get the EU edition (NIS2, AI Act, GDPR, DORA)

Get the PDF

We'll only use your email for what you ticked above, and to follow up on this download. See our Privacy Policy.

The checklist

SOC 2
vendor security evidence
NIST
NIST CSF 2.0 and the NIST AI RMF
Privacy
CCPA/CPRA and other state privacy laws
HIPAA
health data
AI laws
state and city AI rules, e.g. Colorado, NYC
Finance
bank third-party guidance, NYDFS, GLBA

1. Before you say yes

Decide how much scrutiny this vendor needs before anyone starts negotiating.

  • Name a business owner who is accountable for this vendor for its whole life, not just the purchase.
  • Check whether you already pay for a tool that does the same job (SaaS sprawl is where most wasted spend hides).
  • Tier the vendor by risk: what data it touches, which systems it connects to, and what breaks if it fails.NIST
  • Flag vendors that support a regulated or critical activity; they need the deepest review and ongoing monitoring.Finance
  • Ask whether the product uses AI, and whether it's used in decisions about people (hiring, lending, housing, insurance).AI laws

2. Security and SOC 2

Match the depth of review to the risk tier you set above.

  • Get a current SOC 2 Type II report (or ISO 27001 certificate). Type I only shows controls were designed, not that they worked.SOC 2
  • Check the report's scope: the systems and trust services criteria it covers must match what you're buying.SOC 2
  • Read the exceptions and the auditor's opinion, not just the cover page.SOC 2
  • List the complementary user entity controls (CUECs), the controls your own team must run for the vendor's controls to work.SOC 2
  • If the report period ended months ago, ask for a bridge letter covering the gap.SOC 2
  • Ask which subprocessors (fourth parties) handle your data, and how the vendor reviews them.NIST
  • For high-risk vendors, send a standard security questionnaire (for example SIG or CAIQ) and review the answers.

3. Data privacy

Anything that touches personal data needs a paper trail.

  • Map what personal data the vendor will process, whose it is, and which states those people live in.Privacy
  • Include the service-provider terms state privacy laws require, such as limits on using your data for other purposes.Privacy
  • Sign a business associate agreement before any vendor touches protected health information.HIPAA
  • Ask whether your data is used to train the vendor's AI models, and get the answer in writing.Privacy

4. AI tools and agents

For any product that uses AI, and especially agents that act on their own.

  • Get documentation of what the AI does, its known limitations, and how it was tested.NIST
  • Decide who reviews or can override the AI's outputs, and write it down.NIST
  • If AI is used in hiring or other consequential decisions, check state and city rules (for example bias audits for hiring tools in NYC, and Colorado's AI Act).AI laws
  • For agents: list exactly which systems and data they can access and which actions they can take without a human.
  • Plan to re-check permissions after major model or product updates.

5. In the contract

The clauses teams most often regret skipping.

  • Security obligations and a breach-notification timeframe short enough for your own reporting duties.Finance
  • Right to audit or assess, so you can verify what the vendor claims.Finance
  • Service levels, service credits, and your right to terminate for repeated misses.
  • Renewal terms: auto-renewal, the notice period, and the exact date by which you must act.
  • Price increases at renewal: a cap on the uplift, and how much notice you get.
  • Liability caps that reflect a data breach, and proof of cyber insurance (a certificate of insurance).
  • Exit: data return and deletion, transition help, and termination rights.

6. After signing

Due diligence isn't finished at signature.

  • Record every obligation with an owner and a date (payments, notices, reports, certificate renewals).
  • Collect a new SOC 2 report every year, and track certificate and insurance expiry dates.SOC 2
  • Monitor high-risk vendors on an ongoing basis: incidents, performance, and changes in ownership or scope.Finance
  • Before each renewal, check usage and seat counts, then decide renew, renegotiate or cancel before the notice deadline.

7. Offboarding

Ending a vendor safely is part of managing it.

  • Remove all user accounts, API keys and integrations.
  • Get written confirmation that your data has been returned or destroyed.Privacy
  • Close out open obligations and archive the contract with its history.

This checklist is general guidance, not legal advice. Which rules apply to you depends on your industry, size, and the states you operate in, and US privacy and AI laws are changing quickly. Check with your legal or compliance advisers.

Stop med at holde styr på det her i et regneark

Granur kører hver leverandør og hvert AI-værktøj gennem disse tjek, trækker forpligtelser og fornyelsesdatoer ud af kontrakterne automatisk og gemmer revisionssporet for jer.